Board and management
Oversight and accountability.
SC Technology Risk Management Review
An SC technology risk management review checks a capital market entity's technology risk governance, processes and evidence against the SC's Guidelines on Technology Risk Management. The SC's Guidelines on Technology Risk Management replaced the old cyber risk guidelines in 2024 and added near-miss reporting, pre-deployment security assessment and penetration testing of critical systems. We review your compliance and evidence against them.
SC Technology Risk Management Review
What it is
A compliance review of a capital market entity's technology risk governance, processes and evidence against the SC guidelines. It reviews whether required testing happens and is evidenced; it does not perform the testing itself.
Why organisations need it
The guidelines apply to capital market entities including fund managers, brokers, platform operators and trustees. The 2024 revision requires near-miss reporting, a cyber security assessment before deploying a system, penetration testing before deploying new critical systems, and allows the SC to appoint an independent party to review compliance. Many entities have policies but not the evidence.
What the engagement covers
Change and deployment
Pre-deployment assessments and testing gates.
Third parties and cloud
Oversight of providers.
Incidents and near misses
Identification and reporting to the SC.
AI and ML use
Ethical use guidance.
Evidence
Records an SC-appointed reviewer would request.
What the business gets out of it
Ready for scrutiny
Evidence in place.
Current guidelines
The 2024 revision, not the old cyber rules.
Practical gates
Release processes that comply.
Board confidence
Independent view.
Mid-level scope
Compliance review, no intrusive testing.
How it works
How the engagement runs
01
Scoping
Entity and systems.
02
Document review
Policies and records.
03
Walkthroughs
Change, incident and third-party processes.
04
Gap analysis
Against the guidelines.
05
Report
Findings and plan.
Deliverables
What you receive
Review report
Findings by risk.
Guideline mapping
Requirement by requirement.
Near-miss procedure
Draft or review.
Remediation plan
Owners and dates.
Board summary
Position for directors.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
The SC Guidelines on Technology Risk Management, issued on 1 August 2023 and revised on 19 August 2024, which replaced the 2016 Guidelines on Management of Cyber Risk. They apply to capital market entities including fund managers, brokers, platform operators and trustees.
No. The guidelines require penetration testing before new critical systems are deployed; we review whether that testing happens and is properly evidenced. The testing itself is performed by licensed providers.
A near-miss is an event that could have caused a technology incident but did not. The 2024 revision requires near-miss events to be reported to the SC, which many entities have not yet built into their incident process. The review checks yours.
No. The guidelines allow the SC to appoint its own independent party to review compliance, and that reviewer is chosen by the SC. This review prepares you for one, so gaps are found and closed before an independent reviewer looks.
Typically three to six weeks, depending on the size of the entity. The review ends with findings mapped to the guidelines, the evidence gaps behind each one, and a remediation plan.